Big buckets for simplifying records retention schedules.

• Author: Cisco, Susan

Like it or not, all of an organization's recorded information is potentially discoverable in a court-ordered legal discovery or regulatory investigation. This means all recorded information needs to be managed for retention purposes throughout its life-cycle depending on its legal, regulatory, industry, and business value/risk.

Because records retention compliance begins with employees who create, receive, and use records, organizations are searching for ways to make it easier for them to classify records into the correct retention categories.

One solution for helping employees is to use a "big bucket" strategy for simplifying records retention schedules by consolidating record types related to the same business function or process and with similar retention requirements into bigger retention buckets or record series.

With fewer buckets resulting in fewer retention choices, employees and auto-categorization tools are more likely to classify information consistently, which ensures better compliance with an organization's record retention requirements. This, in turn, reduces risks associated with keeping records too long and reduces costs for maintaining and responding to e-discovery demands for large volumes of unneeded records.

Despite these advantages, big bucket proponents cite difficulties associated with managing exceptions. Exceptions include records with event-driven retention requirements and case-type files made up of multiple record types that have different retention requirements. Project files that contain contracts, statements of work, proposals, and deliverables are one such example. (See sidebar, "The Pros and Cons of the 'Big Bucket' Approach.")

This article examines approaches for managing retention of all an organization's recorded information assets, including exceptions, and assesses the progress toward a standardized approach for using bigger retention buckets.

Managing Official Records

An up-to-date retention schedule protects the interests of an organization and its stakeholders by ensuring that the official business records are kept for as long as they are needed to meet legal, regulatory, and operational needs and provides a "safe harbor" for disposing of outdated information. Records and information management (RIM) professionals became familiar with the term "safe harbor" when the U.S. Federal Rules of Civil Procedure were amended on December 1, 2006. Rule 37(e) states that, "absent exceptional circumstances, a court may not impose sanctions under these rules on a party for failing to provide electronically stored information lost as a result of the routine, goodfaith operation of an electronic information system"

In addition to complying with its retention schedule, an organization can do several other things to demonstrate good faith. Bill Tolson, director of legal and regulatory solutions marketing for Mimosa Systems, said this includes establishing policies, processes, and procedures, including for litigation holds; training employees on the policies and procedures on a regular basis; understanding its technology infrastructure, including which systems automatically delete records and ensuring that deletions can be overridden when required for preservation; and adding infrastructure automation to help in meeting the 37(e) responsibilities.

RIM and IT professionals are beginning to agree that about 100 record series is a reasonable number of buckets in an enterprise-wide (even global) retention schedule for most industries, depending on an organization's risk tolerance.

According to Galina Datskovsky, senior vice president and general manager of CA's information governance business unit, risk can increase because bigger buckets may have longer retention periods. "The right size is a carefully measured balance between risk of lengthened retention periods versus the everyday practical benefit of bigger buckets," Datskovsky said.

She said she senses a trend toward big buckets, driven largely by the need to get a handle on...